An implementation is typically checked against a specification by
proving that the implementation implies the specification. This
ensures that the implementation only has behaviors allowed by the
specification. However, this does not require the implementation to
have any behavior at all!

We propose that correctness statements have two parts, corresponding to
liveness and safety. Safety is that the
implementation implies an "allowed-behavior" specification, as now.
Liveness is that a "required-behavior" specification implies the
implementation.